# Missing OWASP Secure Headers - Redirection Problem

**URL:** <https://devforum.zoom.us/t/missing-owasp-secure-headers-redirection-problem/76685>\
**Category:** Zoom Apps\
**Created:** [September 29, 2022, 8:02am UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-redirection-problem/76685 "2022-09-29T08:02:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![quizflight](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/quizflight/32/38885_2.png) [@quizflight](https://devforum.zoom.us/u/quizflight)\
**Post date:** [September 29, 2022, 8:02am UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-redirection-problem/76685/1 "2022-09-29T08:02:52Z")

</div>

Hi there,

There is a redirection to [auth.ourdomain.com](http://auth.ourdomain.com) which also redirects to Google, Facebook and Microsoft in order to let user sign in via these accounts.

We are getting following error;

`Missing OWASP Secure Headers: ["X-Content-Type-Options","Content-Security-Policy","Referrer-Policy"] for URL https:// **.**.com/__/auth/handler?apiKey= **** &appName=%5BDEFAULT%5D&authType=signInViaRedirect&providerId=google.com&scopes=profile`

We can control our headers but we can no do same for google or facebooks auth windows

Do you have any suggestions?

---

<div class="post-metadata">

**Author:** ![quizflight](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/quizflight/32/38885_2.png) [@quizflight](https://devforum.zoom.us/u/quizflight)\
**Post date:** [October 17, 2022, 1:08pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-redirection-problem/76685/3 "2022-10-17T13:08:09Z")

</div>

We will continue with Zoom Auth so you can close this.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![JonStewart](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jonstewart/32/36192_2.png) [@JonStewart](https://devforum.zoom.us/u/JonStewart)\
**Post date:** [October 17, 2022, 9:16pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-redirection-problem/76685/4 "2022-10-17T21:16:28Z")

</div>

These headers are required. For now, though, the recommendation is to handle 3rd party authentication in the system browser. To do that, you’ll need to authenticate on [zoom.us](http://zoom.us) before redirecting. Pls see the advanced reference app for this:

> **[GitHub - zoom/zoomapps-advancedsample-react: This repository contains an...](https://github.com/zoom/zoomapps-advancedsample-react)**
>
> This repository contains an Advanced Zoom Apps Sample. It should serve as a starting point for you to build and test your own Zoom App in development. - GitHub - zoom/zoomapps-advancedsample-react:...